{
  "id": 19919268,
  "title": "Barracuda ESG Exploited: Patch vs Admin UI Lockdown",
  "url": "https://urgent.news/2026/11/14/barracuda-esg-exploited-patch-vs-admin-ui-lockdown",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-14T04:43:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/shaam_ai/barracuda-esg-exploited-patch-vs-admin-ui-lockdown-32p0"
  },
  "original_language": "en",
  "account": "Barracuda Networks confirmed on November 9, 2026 that attackers are exploiting two vulnerabilities - CVE-2026-116606 and CVE-2026-111560 - in its Email Security Gateway (ESG). The vulnerabilities allow a pre-authentication authorisation bypass and command injection, which together can give attackers root access to the device. The Federal Coordination of Vulnerabilities Team (CISA) added the vulnerabilities to its Known Exploited Vulnerabilities catalogue on November 10 with a deadline of November 13 for US federal agencies to take action. Barracuda recommends applying firmware update 9.4.0.029 or later as the primary defence. As a stopgap, restricting the Admin UI to internal networks offers immediate protection against unauthenticated attackers. The vulnerabilities work together - the first removes the need for credentials, and the second provides code execution. Patching alone does not remove an existing intruder. Indian organizations running the appliance are obligated to report exploitation to CERT-In within six hours if they detect it.",
  "summary": "Barracuda ESG exploited is no longer a theoretical risk. Barracuda Networks confirmed on 9 November 2026 that attackers are chaining CVE-2026-116606 and CVE-2026-111560 against its Email Security Gateway, and CISA added both to its Known Exploited Vulnerabilities catalogue on 10 November with a federal deadline of 13 November. Of the two defences available, patching to firmware 9.4.0.029 or later…",
  "key_points": [
    "Barracuda confirms vulnerabilities CVE-2026-116606 and CVE-2026-111560 in ESG.",
    "Exploits allow pre-authentication authorisation bypass and command injection.",
    "Patching alone insufficient; immediate UI restriction recommended."
  ],
  "editors_take": "The combination of authorization bypass and command injection flaws transforms a standard security appliance into a root-access gateway for attackers, forcing federal agencies and global organizations into immediate remediation.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}